public Relocations(BinaryReader reader, MModule mod) { uint start, end; if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[5].Rva == 0) { return; } start = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[5].Rva); end = start + mod.ModHeaders.OSHeaders.PEHeader.DataDirs[5].Size; //fill in Region props Start = start; Length = end - start; reader.BaseStream.Position = start; RelocationBlock block; ArrayList arr = new ArrayList(); while (reader.BaseStream.Position < end) { block = new RelocationBlock(reader); arr.Add(block); } _blox = (RelocationBlock[])arr.ToArray(typeof(RelocationBlock)); }
public ImportAddress(uint n, BinaryReader reader, MModule mod) { if ((n & 0x80000000) != 0) { _ByOrdinal = true; } else { _ByOrdinal = false; } if (_ByOrdinal) { _Ordinal = n & 0x7fffffff; } else { uint nameOffs = n & 0x7fffffff; long offs = reader.BaseStream.Position; reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(nameOffs); reader.ReadInt16(); //hint byte b = reader.ReadByte(); while (b != 0) { _Name += (char)b; b = reader.ReadByte(); } reader.BaseStream.Position = offs; } }
public MDBlob(BinaryReader reader) { //read length indicator _length = MModule.DecodeInt32(reader); _data = reader.ReadBytes(_length); }
public MDTables(BinaryReader reader, MModule mod) { _mod = mod; SetupSchema(reader); //reader may now be accessed randomly to fill in actual strings etc. }
public ExportDirTable(BinaryReader reader, MModule mod) { _ExportFlags = reader.ReadUInt32(); _TimeStamp = reader.ReadUInt32(); _MajorVersion = reader.ReadUInt16(); _MinorVersion = reader.ReadUInt16(); _Name = mod.StringFromRVA(reader, reader.ReadUInt32()); _OrdinalBase = reader.ReadUInt32(); _AddressTableEntries = reader.ReadUInt32(); _NamePointerCount = reader.ReadUInt32(); _ExportAddressTableRVA = reader.ReadUInt32(); _NamePointerRVA = reader.ReadUInt32(); _OrdinalRVA = reader.ReadUInt32(); }
public override void GenerateChildren() { base.GenerateChildren(); AModule m = (AModule)_data; Genetibase.Debug.FileViewer.MModule mod = null; BinaryReader r; try { FileStream stream = new FileStream(m.FileName, FileMode.Open, FileAccess.Read, FileShare.ReadWrite); r = new BinaryReader(stream); } catch//(Exception e) { // Nodes.Add(new ErrorNode("Can't open this file: " + e.Message)); return; } mod = new Genetibase.Debug.FileViewer.MModule(r); Assembly asm = m.Assembly; if (asm != null) { Nodes.Add(new AsmNode(asm)); } //the purpose of this 'try' is to allow us to add as many nodes as the MModule might happen to contain try { int root = Nodes.Add(new FolderNode("Headers")); Nodes[root].Nodes.Add(new FileRegionNode(mod.ModHeaders.OSHeaders)); if(mod.ModHeaders.COR20Header != null) { Nodes[root].Nodes.Add(new FileRegionNode(mod.ModHeaders.COR20Header)); Nodes[root].Nodes.Add(new FileRegionNode(mod.ModHeaders.MetaDataHeaders)); Nodes[root].Nodes.Add(new FileRegionNode(mod.ModHeaders.MetaDataTableHeader)); } root = Nodes.Add(new FolderNode("Imports/Exports")); if (mod.ImportExport.ExportDirectoryTable != null) Nodes[root].Nodes.Add(new FileRegionNode(mod.ImportExport.ExportDirectoryTable)); if (mod.ImportExport.Exports.Length > 0) { int n = Nodes[root].Nodes.Add(new FolderNode("Exports")); for(int i=0;i< mod.ImportExport.Exports.Length; ++i) { Nodes[root].Nodes[n].Nodes.Add(new ObjNode(mod.ImportExport.Exports[i], false)); } } if (mod.ImportExport.ImportDirectoryEntries.Length > 0) { int n = Nodes[root].Nodes.Add(new FolderNode("Imports")); for(int i=0;i< mod.ImportExport.ImportDirectoryEntries.Length; ++i) { Nodes[root].Nodes[n].Nodes.Add(new FileRegionNode(mod.ImportExport.ImportDirectoryEntries[i])); } } root = Nodes.Add(new FolderNode("Relocations")); for(int i=0; i < mod.Relocations.Blocks.Length; ++i) { Nodes[root].Nodes.Add(new FileRegionNode(mod.Relocations.Blocks[i])); } root = Nodes.Add(new FolderNode("Heaps")); Nodes[root].Nodes.Add(new MDHeapNode(mod.StringHeap)); Nodes[root].Nodes.Add(new MDHeapNode(mod.BlobHeap)); Nodes[root].Nodes.Add(new MDHeapNode(mod.GUIDHeap)); if (mod.USHeap != null) Nodes[root].Nodes.Add(new MDHeapNode(mod.USHeap)); root = Nodes.Add(new FolderNode("Tables")); for(int i=0; i< mod.MDTables.Tables.Length; ++i) { Nodes[root].Nodes.Add(new TableNode(mod.MDTables.Tables[i])); } } catch//(Exception e) { Nodes.Add(new ErrorNode("Not all parts of this module could be read -- is it a valid .NET module?")); } }
public ImpExports(BinaryReader reader, MModule mod) { ArrayList ides = new ArrayList(); ImportDirectoryEntry ide = null; _exports = new ExportRecord[0]; _ith = new ImportDirectoryEntry[0]; //imports if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Rva != 0) { uint start, end; start = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Rva); end = mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Size + start; reader.BaseStream.Position = start; while (reader.BaseStream.Position < end) { ide = new ImportDirectoryEntry(reader, mod); //in older PEs it seems there is no null terminating entry, but in .NET ones there is. if (ide.Name == null) { break; } else { ides.Add(ide); } } _ith = (ImportDirectoryEntry[])ides.ToArray(typeof(ImportDirectoryEntry)); } //exports if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[0].Rva != 0) { reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[0].Rva); _extab = new ExportDirTable(reader, mod); _expAddrTab = new uint[_extab.AddressTableEntries]; _expNameTab = new string[_extab.NamePointerCount]; _expOrdTab = new uint[_extab.NamePointerCount]; reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.ExportAddressTableRVA); for (int i = 0; i < _extab.AddressTableEntries; ++i) { _expAddrTab[i] = reader.ReadUInt32(); } reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.OrdinalRVA); for (int i = 0; i < _extab.NamePointerCount; ++i) { _expOrdTab[i] = reader.ReadUInt16(); } reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.NamePointerRVA); for (int i = 0; i < _extab.NamePointerCount; ++i) { _expNameTab[i] = mod.StringFromRVA(reader, reader.ReadUInt32()); } //assemble array of exportrecords uint len = _extab.AddressTableEntries; if (len > _extab.NamePointerCount) { len = _extab.NamePointerCount; } _exports = new ExportRecord[len]; for (int i = 0; i < len; ++i) { _exports[i] = new ExportRecord(_expOrdTab[i], _expAddrTab[i], _expNameTab[i]); } } }
public ImportDirectoryEntry(BinaryReader reader, MModule mod) { Start = reader.BaseStream.Position; uint iltRVA = reader.ReadUInt32(); _DateTimeStamp = reader.ReadUInt32(); _ForwarderChain = reader.ReadUInt32(); uint nameRVA = reader.ReadUInt32(); _Name = mod.StringFromRVA(reader, nameRVA); uint iatRVA = reader.ReadUInt32(); //can also get this from the PEHeader's data dirs Length = reader.BaseStream.Position - Start; long offs = reader.BaseStream.Position; // remember our position at the end of the imp dir entry record if (nameRVA == 0) { //indicate that this is not valid, because we reached the null terminating record //or because we are hopelessly lost _Name = null; return; } try { //get imp look table from RVA ArrayList arr; uint tableOffs, field; if (iltRVA != 0) { arr = new ArrayList(); tableOffs = mod.ModHeaders.Rva2Offset(iltRVA); reader.BaseStream.Position = tableOffs; field = reader.ReadUInt32(); while (field != 0) { arr.Add(new ImportAddress(field, reader, mod)); field = reader.ReadUInt32(); } _ImportLookupTable = (ImportAddress[])arr.ToArray(typeof(ImportAddress)); } //get imp Addr table from RVA if (iatRVA != 0) { arr = new ArrayList(); tableOffs = mod.ModHeaders.Rva2Offset(iatRVA); reader.BaseStream.Position = tableOffs; field = reader.ReadUInt32(); while (field != 0) { arr.Add(field); field = reader.ReadUInt32(); } _ImportAddressTable = (uint[])arr.ToArray(typeof(uint)); } } catch //(Exception e) { } finally { //restore stream pos reader.BaseStream.Position = offs; } }